Widespread use of networks to interconnect heterogenous computer services is common today. Typically, in a distributed processing environment, a user will access an unsecured workstation and, using the workstation itself, access a variety of other computer services on the network. But as the use of networks has increased so have the problems relating to securing and controlling the legitimate access of users to the computer systems.
Traditionally, access to computer services was controlled through the use of passwords. Each user was associated with a user id and a password. Both the computer system and the user who wished to access a service had to know the password. The user provided the user id and the computer systems challenged the user to then provide the password. This initiated access to the system.
FIG. 1 represents a typical prior art computer network configuration. A user 10 accesses a workstation 14 which is connected to a network 18. The user 10 then accesses services 20, 22 and 24 from the workstation 14 via the network 18. User authentication is controlled through the use of a password 11 known only by user 10 and services 20, 22 and 24.
A weakness with this authentication scheme can be seen in FIG. 2. Since the workstation 14 is often installed in an unsecured environment, an illicit user may install a trojan horse 15 on the workstation 14 to spy on the input of password 11 by user 10. Further, a password thief 12 may borrow or steal the password 11 from user 10. Finally, a network eavesdropper 16 can intercept the transmission of password 11 to services 20, 22 and 24. All of these methods may be utilized to gain illicit access to service 20, 22 and 24. It will be appreciated that the network 18 can connect many other untrusted workstations and services, compounding the danger if illicit access to network services.
As seen, in a distributed processing environment, a user often needs to access resources located at multiple servers from multiple workstations interconnected via a communications network. Authentication to each host accessed is crucial, but presenting separate user id/password pairs can be both unwieldy and unsecure. What is needed is a mechanism which requires users to identify and authenticate themselves once to a trusted agent which then performs the necessary user identification and authentication to each accessed resource transparently. This is known as unitary login.
Previous work in developing secure unitary login protocols for distributed systems include those intended for open environments (e.g., the Massachusetts Institute of Technology Kerberos protocol, the Digital Equipment Corporation SPX protocol, the Carnegie Mellon University Strongbox protocol, and the ISO OSI Directory Services protocols) and those intended for closed environments (e.g., the World Wide Military Command and Control System (WWMCCS) Information System Network Authentication Service (WISNAS) protocol, the Department of Defense Intelligence Information System Network Security for Information Exchange (DNSIX) protocol, and the Strategic Air Command Intelligence Network (SACINTNET) protocol).
Each of these protocols provides different authentication services (e.g., Kerberos, SPX, WISNAS, DNSIX, and SACINTNET are more connection-oriented while Strongbox and the OSI Directory Services are more process-oriented) and depends upon different mechanisms to provide security (e.g., Kerberos employs conventional encryption, Strongbox employs zero-knowledge proofs, SPX and OSI Directory Services employ public key encryption). None of them are intended for a truly hostile environment (i.e., one subject to active attacks against both workstations/servers and the network). WISNAS, DNSIX and SACINTNET, though designed for military applications, are intended for physically secure environments with trusted users and no eavesdropping threats. The other protocols protect against the threat of network eavesdropping but assume that workstations and servers are protected by other mechanisms (e.g., physical ownership/control). Organizations could greatly ease the problems associated with password management and the threat from masquerading on their increasingly distributed information systems with a unitary login capability which was secure from both a workstation/server and a network perspective.
The Kerberos protocol possesses many advantages as a basis for this capability. Originally developed to provide user authentication for the distributed open computing environment of MIT's Project Athena, Kerberos is growing significantly in popularity (it has been adopted by the Open Software foundation and Unix International as well as being offered in several commercial products). It is based upon the use of a trusted authentication server to provide "tickets" for presentation to other system servers and uses algorithm-independent conventional (secret) key encryption to protect against network eavesdropping and masquerading. This latter feature is especially important for military/intelligence applications in that the current Data Encryption Standard (DES) algorithm might be inadequate for certain environments. If so, it can easily be replaced with a stronger algorithm.
Kerberos utilizes a trusted central authentication server, the Kerberos Authentication Server (KAS). The KAS contains a database of system entities (registered users and services) and its private cryptographic keys. Each user and each service is a separate entry, each with their own cryptographic key. These private keys, known only to the respective entity and the KAS, allow the KAS to communicate privately with the Kerberos agent of each system service (server Kerberos) and with the Kerberos agent of each registered user who wishes to be logged in (client Kerberos). The KAS also contains a "ticket" granting service to provide a trusted means for logged in users to prove their identity to system services. Finally, it contains a key generation service which supplies authorized pairs of entities with temporary cryptographic keys.
The Kerberos protocol is based upon the concept of tickets and authenticators. A ticket is issued by the KAS for a single user and a specified service. It contains the service id, the user id, the user's (workstation) address, a timestamp, the ticket's lifetime and a randomly chosen session key to be used by this service. This information is protected by encryption under the service's private key. Since this key is known only to the service and the KAS, the service is assured of the authenticity of the ticket. Once a ticket is issued, it can be reused by the named user to gain access to the indicated service until it expires. A new ticket can be issued upon the user's presenting his/her appropriate credentials.
Unlike the ticket, the authenticator is built by client Kerberos. A new one must be generated every time the user wishes to use a ticket. An authenticator contains the user's id, the user's (workstation) address, and a timestamp. The authenticator is encrypted with the session key which is associated with the ticket. Encryption of the authenticator assures the service that the user presenting the ticket is the user to whom the original ticket was issued. The agreement of the user id in the authenticator with the user id in the ticket and the address in the authenticator with the address in the ticket proves a user's authenticity. Agreement of the timestamp with the current time proves that this is a fresh ticket/authenticator pair and not a replay of an old pair.
Security within Kerberos is enforced through the protection of session keys during transmission. The initial response from the KAS to the client, upon presentation of the user id, consists of a ticket to the ticket granting service and its associated session key. The ticket granting service ticket is encrypted with the ticket granting service's private key. The ticket granting service session key is encrypted with the client's private key. Additional session keys associated with tickets to system service requested by that particular client are henceforth encrypted in the ticket granting service session key.
Kerberos has been analyzed from a general security perspective. A significant vulnerability involves its manipulation of the user's Kerberos password and other sensitive authentication information (i.e., session keys) within the workstation, thereby making it vulnerable to Trojan Horse threats which could capture such data for later use by an intruder. Another vulnerability involves the threat of repeated attacks at the intruder's leisure following interception of the initial response from the authentication server. This response contains the ticket granting server ticket (required for obtaining other tickets) and its associated session key, which is encrypted using a relatively weak password-derived key. A third vulnerability involves the inherent weakness of depending solely upon a single factor (i.e., a password) for the initial user authentication. Passwords can be easily borrowed or stolen.